appswap[.]org

The domain appswap.org was registered on 2026-06-06 through the registrar Internet Domain Service BS Corp. Within weeks of its creation the site surfaced on three independent security blocklists and is presently listed by PhishDestroy, MetaMask, and SEAL as a malicious resource. Google Safe Browsing has classified the domain under the social engineering category, indicating that it is being used to lure users into credential‑stealing or other deceptive interactions. VirusTotal analysis shows that 18 of 91 scanning engines flagged the domain as malicious, reinforcing the blocklist observations.

All available indicators point to a high‑risk, active phishing operation, yet additional technical details such as hosting IP address, autonomous system number, geographic location, SSL certificate properties, HTTP response codes, or page title have not been published in the current intelligence set. Consequently, the precise infrastructure used by the actors behind appswap.org remains opaque. Defenders should immediately block traffic to appswap.org at network perimeters and endpoint security solutions.

Email gateways should be updated to reject messages containing links to this domain, and web filtering products must enforce the blocklist entries. Continuous monitoring of the domain’s reputation across additional threat‑intel feeds is advised, as further artifacts—such as malicious payloads or credential harvesters—may emerge. Organizations that have observed any authentication attempts to appswap.org should treat those events as compromised and initiate standard incident‑response procedures, including credential rotation and user notification.